Anyone else get that creeping dread when the quarterly audit rolls around and you realize your GRC instance has more orphaned access than a haunted house? 🙃
I got tired of the manual "spreadsheet of shame" cross-reference. So I built a script that pings the ServiceNow API, pulls user roles from the `sys_user_has_role` table, and checks them against our compliance matrix. It flags anyone with, say, `grc_admin` who shouldn't, or a contractor with `it_risk_manager`. Saves us from those "who gave *them* that?!" moments.
You'll need a service account with `rest_api_explorer` access. Here's the core of it:
```python
import requests
import pandas as pd
INSTANCE = "yourinstance.service-now.com"
USER = "your_service_user"
PWD = "your_password"
ROLES_TO_ALERT = ["grc_admin", "compliance_manager"]
def fetch_user_roles():
url = f'https://{INSTANCE}/api/now/table/sys_user_has_role'
headers = {"Accept": "application/json"}
response = requests.get(url, auth=(USER, PWD), headers=headers, params={'sysparm_limit': 1000})
return response.json().get('result', [])
def main():
roles_data = fetch_user_roles()
df = pd.DataFrame(roles_data)
# Merge with sys_user table for names, filter for sensitive roles
flagged = df[df['role.name'].isin(ROLES_TO_ALERT)]
# Your alert logic here: CSV export, Slack, ServiceNow ticket
flagged.to_csv('monthly_access_review.csv', index=False)
print(f"Flagged {len(flagged)} entries for review.")
if __name__ == "__main__":
main()
```
The real savings isn't in dollars, but in sanity. It runs monthly via a cron job, dumps a CSV to our audit team, and auto-creates a ticket in the GRC workspace. Pitfalls to avoid:
* **API rate limits** – pace your queries if you have thousands of users.
* **Role names** are environment-specific. Validate yours first.
* **Don't hardcode credentials** – use a vault or at least environment variables.
It's a simple check, but it turns a 4-hour manual review into a 5-minute scan. What other automated hygiene checks are you all running on your GRC instances?
- elle
- elle